EP3619888B1 - Automatisierte zertifikatsregistrierung für vorrichtungen in industriereglerystemen oder anderen systemen - Google Patents
Automatisierte zertifikatsregistrierung für vorrichtungen in industriereglerystemen oder anderen systemen Download PDFInfo
- Publication number
- EP3619888B1 EP3619888B1 EP18794197.6A EP18794197A EP3619888B1 EP 3619888 B1 EP3619888 B1 EP 3619888B1 EP 18794197 A EP18794197 A EP 18794197A EP 3619888 B1 EP3619888 B1 EP 3619888B1
- Authority
- EP
- European Patent Office
- Prior art keywords
- certificate
- digital certificate
- certification authority
- digital
- request
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 claims description 82
- 238000004891 communication Methods 0.000 claims description 44
- 230000015654 memory Effects 0.000 claims description 22
- 230000005540 biological transmission Effects 0.000 claims description 5
- 230000004044 response Effects 0.000 claims description 5
- 238000009434 installation Methods 0.000 claims 2
- 230000008569 process Effects 0.000 description 26
- 230000006870 function Effects 0.000 description 20
- 238000004519 manufacturing process Methods 0.000 description 19
- 101150084419 CSR2 gene Proteins 0.000 description 14
- 238000003860 storage Methods 0.000 description 9
- 238000012545 processing Methods 0.000 description 8
- 238000007726 management method Methods 0.000 description 6
- 238000004801 process automation Methods 0.000 description 6
- 101000693970 Homo sapiens Scavenger receptor class A member 3 Proteins 0.000 description 5
- 102100027192 Scavenger receptor class A member 3 Human genes 0.000 description 5
- 230000007246 mechanism Effects 0.000 description 5
- 230000003287 optical effect Effects 0.000 description 4
- 238000013459 approach Methods 0.000 description 3
- 230000003993 interaction Effects 0.000 description 3
- 238000005259 measurement Methods 0.000 description 3
- 238000004590 computer program Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000002085 persistent effect Effects 0.000 description 2
- 238000004886 process control Methods 0.000 description 2
- 238000012795 verification Methods 0.000 description 2
- 238000003491 array Methods 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 230000008676 import Effects 0.000 description 1
- 238000003780 insertion Methods 0.000 description 1
- 230000037431 insertion Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 238000012552 review Methods 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 238000010200 validation analysis Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
- H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
Definitions
- This disclosure generally relates to computing and device security . More specifically, this disclosure relates to automated certificate enrollment for devices in industrial control systems or other systems.
- ICSs Industrial control systems
- US 2014/281497 A1 relates to a method for updating identity data on network-enabled devices. The method provides for providing certificate signing requests and/or device identifiers to an external trust authority, which in response generates digital certificates and/or key pairs.
- US 2008/184030 A1 relates to a digital certificate associating a unique identifier for a computer-based appliance with an authentication key pair for that appliance, obtained from a certificate authority using a different, manufacturing key pair for the appliance.
- US 2013/073856 A1 relates to a certificate enrollment assistant module to inject a challenge password into a certificate signing request to be sent, to a Certificate Authority, from a computing device.
- This disclosure provides automated certificate enrollment for devices in industrial control systems or other systems.
- a method in a first embodiment, includes receiving, from a device, (i) a certificate request for a certification authority and (ii) a first digital certificate.
- the certificate request is digitally signed by the first device, and the first digital certificate is stored in the device.
- the method also includes verifying, at the certification authority, the first digital certificate using a second digital certificate of another certification authority.
- the method further includes verifying a digital signature of the certificate request using the first digital certificate.
- the method includes, after verifying the first digital certificate and the digital signature, transmitting a second digital certificate to the device.
- an apparatus configured to provide a certification authority and includes at least one processor.
- the at least one processor is configured to receive, from a device, (i) a certificate request for the certification authority and (ii) a first digital certificate.
- the certificate request is digitally signed by the first device, and the first digital certificate is stored in the device.
- the at least one processor is also configured to verify the first digital certificate using a second digital certificate of another certification authority.
- the at least one processor is further configured to verify a digital signature of the certificate request using the first digital certificate.
- the at least one processor is configured, after verifying die first digital certificate and the digital signature, to initiate transmission of a second digital certificate to the device.
- a method in a third embodiment, includes generating a key pair having first and second keys associated with a device. The method also includes generating a certificate request associated with the key pair and digitally signing the certificate request. The method further includes transmitting the certificate request and a first digital certificate stored in the device to a certification authority. In addition, the method includes, in response to the certification authority verifying the first digital certificate and a digital signature of the certificate request, receiving a second digital certificate from the certification authority and storing the second digital certificate in the device.
- an apparatus in a fourth embodiment, includes at least one memory configured to store a first digital certificate and at least one processor.
- the at least one processor is configured to generate a key pair having first and second keys associated with the apparatus.
- the at least one processor is also configured to generate a certificate request associated with the key pair and digitally sign the certificate request.
- the at least one processor is further configured to initiate transmission of the certificate request and the first digital certificate to a certification authority.
- the at least one processor is configured, in response to the certification authority verifying the first digital certificate and a digital signature of the certificate request, to receive a second digital certificate from the certification authority and store the second digital certificate in the at least one memory.
- a non-transitory computer readable medium contains instructions that when executed cause at least one processing device to perform the method of the first embodiment. In a sixth embodiment, a non-transitory computer readable medium contains instructions that when executed cause at least one processing device to perform the method of the third embodiment.
- FIGURES 1 through 7 discussed below, and the various embodiments used to describe the principles of the present invention in this patent document are by way of illustration only and should not be construed in any way to limit the scope of the invention. Those skilled in the art will understand that the principles of the invention may be implemented in any type of suitably arranged device or system.
- Certificate enrollment protocols often require a one-time password to be used for each certificate request. For instance, one common enrollment process occurs as follows. A password generated on a certification authority is delivered over a secure channel to the requesting device, which places the password into a certificate signing request (CSR) that is sent to the certification authority over a secure channel.
- CSR certificate signing request
- This disclosure provides techniques that allow devices to automatically enroll for key certificates.
- the techniques described in this patent document can be fully automated, and device whitelisting can optionally be used to make the techniques more secure. Note that while often described below as being used for embedded devices within industrial control systems, the techniques described in this patent document could be used with any other suitable devices, and those devices could be used in any other suitable systems. Also, note that while often described below as involving device manufacturers and device users (customers), the techniques described in this patent document could be used by any other suitable parties.
- FIGURE 1 illustrates an example industrial process control and automation system 100 according to this disclosure.
- the system 100 includes various components that facilitate production or processing of at least one product or other material.
- the system 100 is used here to facilitate control over components in one or multiple plants 101a-101n.
- Each plant 101a-101n represents one or more processing facilities (or one or more portions thereof), such as one or more manufacturing facilities for producing at least one product or other material.
- each plant 101a-101n may implement one or more processes and can individually or collectively be referred to as a process system.
- a process system generally represents any system or portion thereof configured to process one or more products or other materials in some manner.
- Level 0 may include one or more sensors 102a and one or more actuators 102b.
- the sensors 102a and actuators 102b represent components in a process sy stem that may perform any of a wide variety of functions.
- the sensors 102a could measure a wide variety of characteristics in the process system, such as temperature, pressure, or flow rate.
- the actuators 102b could alter a wide variety of characteristics in the process system.
- the sensors 102a and actuators 102b could represent any other or additional components in any suitable process system.
- Each of the sensors 102a includes any suitable structure for measuring one or more characteristics in a process system.
- Each of the actuators 102b includes any suitable structure for operating on or affecting one or more conditions in a process system.
- One or more networks 104 are coupled to the sensors 102a and actuators 102b.
- the network 104 facilitates interaction with the sensors 102a and actuators 102b.
- the network 104 could transport measurement data from the sensors 102a and provide control signals to the actuators 102b.
- the network 104 could represent any suitable network or combination of networks.
- the network 104 could represent an Ethernet network, an electrical signal network (such as a HART network), a pneumatic control signal network, or any other or additional type(s) of network(s).
- Level 1 includes one or more controllers 106, which are coupled to the network 104.
- each controller 106 may use the measurements from one or more sensors 102a to control the operation of one or more actuators 102b.
- Each controller 106 includes any suitable structure for controlling one or more aspects of a process system.
- each controller 106 could represent a computing device running a real-time operating system, a WINDOWS operating system, or other operating system.
- Redundant networks 108 are coupled to the controllers 106.
- the networks 108 facilitate interaction with the controllers 106, such as by transporting data to and from the controllers 106.
- the networks 108 could represent any suitable redundant networks.
- the networks 108 could represent a pair of Ethernet networks or a redundant pair of Ethernet networks, such as a FAULT TOLERANT ETHERNET (FTE) network from HONEYWELL INTERNATIONAL INC.
- FTE FAULT TOLERANT ETHERNET
- At least one switch/firewall 110 couples the networks 108 to two networks 112.
- the switch/firewall 110 may transport traffic from one network to another.
- the switch/firewall 110 may also block traffic on one network from reaching another network.
- the switch/firewall 110 includes any suitable structure for providing communication between networks, such as a HONEYWELL CONTROL FIREWALL (CF9) device.
- the networks 112 could represent any suitable networks, such as a pair of Ethernet networks or an FTE network.
- Level 2 may include one or more machine-level controllers 114 coupled to the networks 112.
- the machine-level controllers 114 perform various functions to support the operation and control of the controllers 106, sensors 102a, and actuators 102b, which could be associated with a particular piece of industrial equipment (such as a boiler or other machine).
- the machine-level controllers 114 could log information collected or generated by the controllers 106, such as measurement data from the sensors 102a or control signals for the actuators 102b.
- the machine-level controllers 114 could also execute applications that control the operation of the controllers 106, thereby controlling the operation of the actuators 102b.
- the machine-level controllers 114 could provide secure access to the controllers 106, Each of the machine-level controllers 114 includes any suitable structure for providing access to, control of, or operations related to a machine or other individual piece of equipment. Each of the machine-level controllers 114 could, for example, represent a server computing device running a MICROSOFT WINDOWS operating system or other operating system. Although not shown, different machine-level controllers 114 could be used to control different pieces of equipment in a process system (where each piece of equipment is associated with one or more controllers 106, sensors 102a, and actuators 102b).
- One or more operator stations 116 are coupled to the networks 112.
- the operator stations 116 represent computing or communication devices providing user access to the machine-level controllers 114, which could then provide user access to the controllers 106 (and possibly the sensors 102a and actuators 102b).
- the operator stations 116 could allow users to review the operational history of the sensors 102a and actuators 102b using information collected by the controllers 106 and/or the machine-level controllers 114.
- the operator stations 116 could also allow the users to adjust the operation of the sensors 102a, actuators 102b, controllers 106, or machine-level controllers 114.
- the operator stations 116 could receive and display warnings, alerts, or other messages or displays generated by the controllers 106 or the machine-level controllers 114.
- Each of the operator stations 116 includes any suitable structure for supporting user access and control of one or more components in the system 100.
- Each of the operator stations 116 could, for example, represent a computing device running a MICROSOFT WINDOWS operating system or other operating system.
- At least one router/firewall 118 couples the networks 112 to two networks 120.
- the router/firewall 118 includes any suitable structure for providing communication between networks, such as a secure router or combination router/firewall.
- the networks 120 could represent any suitable networks, such as a pair of Ethernet networks or an FTE network.
- Level 3 may include one or more unit-level controllers 122 coupled to the networks 120.
- Each unit-level controller 122 is typically associated with a unit in a process system, which represents a collection of different machines operating together to implement at least part of a process.
- the unit-level controllers 122 perform various functions to support the operation and control of components in the lower levels.
- the unit-level controllers 122 could log information collected or generated by the components in the lower levels, execute applications that control the components in the lower levels, and provide secure access to the components in the lower levels.
- Each of the unit-level controllers 122 includes any suitable structure for providing access to, control of, or operations related to one or more machines or other pieces of equipment in a process unit.
- Each of the unit-level controllers 122 could, for example, represent a server computing device running a MICROSOFT WINDOWS operating system or other operating system. Although not shown, different unit-level controllers 122 could be used to control different units in a process system (where each unit is associated with one or more machine-level controllers 114, controllers 106, sensors 102a, and actuators 102b).
- Access to the unit-level controllers 122 may be provided by one or more operator stations 124.
- Each of the operator stations 124 includes any suitable structure for supporting user access and control of one or more components in the system 100.
- Each of the operator stations 124 could, for example, represent a computing device running a MICROSOFT WINDOWS operating system or other operating system.
- At least one router/firewall 126 couples the networks 120 to two networks 128.
- the router/firewall 126 includes any suitable structure for providing communication between networks, such as a secure router or combination router/firewall.
- the networks 128 could represent any suitable networks, such as a pair of Ethernet networks or an FTE network.
- Level 4" may include one or more plant-level controllers 130 coupled to the networks 128.
- Each plant-level controller 130 is typically associated with one of the plants 101a-101n, which may include one or more process units that implement the same, similar, or different processes.
- the plant-level controllers 130 perform various functions to support the operation and control of components in the lower levels.
- the plant-level controller 130 could execute one or more manufacturing execution system (MES) applications, scheduling applications, or other or additional plant or process control applications.
- MES manufacturing execution system
- Each of the plant-level controllers 130 includes any suitable structure for providing access to, control of, or operations related to one or more process units in a process plant.
- Each of the plant-level controllers 130 could, for example, represent a server computing device running a MICROSOFT WINDOWS operating system or other operating system.
- Access to the plant-level controllers 130 may be provided by one or more operator stations 132.
- Each of the operator stations 132 includes any suitable structure for supporting user access and control of one or more components in the system 100.
- Each of the operator stations 132 could, for example, represent a computing device running a MICROSOFT WINDOWS operating system or other operating system.
- At least one router/firewall 134 couples the networks 128 to one or more networks 136.
- the router/firewall 134 includes any suitable structure for providing communication between networks, such as a secure router or combination router/firewall.
- the network 136 could represent any suitable network, such as an enterprise-wide Ethernet or other network or all or a portion of a larger network (such as the Internet).
- Level 5" may include one or more enterprise-level controllers 138 coupled to the network 136.
- Each enterprise-level controller 138 is typically able to perform planning operations for multiple plants 101a-101n and to control various aspects of the plants 101a-101n.
- the enterprise-level controllers 138 can also perform various functions to support the operation and control of components in the plants 101a-101n.
- the enterprise-level controller 138 could execute one or more order processing applications, enterprise resource planning (ERP) applications, advanced planning and scheduling (APS) applications, or any other or additional enterprise control applications.
- ERP enterprise resource planning
- APS advanced planning and scheduling
- Each of the enterprise-level controllers 138 includes any suitable structure for providing access to, control of, or operations related to the control of one or more plants.
- Each of the enterprise-level controllers 138 could, for example, represent a server computing device running a MICROSOFT WINDOWS operating system or other operating system.
- the term "enterprise” refers to an organization having one or more plants or other processing facilities to be managed. Note that if a single plant 101a is to be managed, the functionality of the enterprise-level controller 138 could be incorporated into the plant-level controller 130.
- Access to the enterprise-level controllers 138 may be provided by one or more operator stations 140.
- Each of the operator stations 140 includes any suitable structure for supporting user access and control of one or more components in the system 100.
- Each of the operator stations 140 could, for example, represent a computing device running a MICROSOFT WINDOWS operating system or other operating system.
- a historian 142 is also coupled to the network 136 in this example.
- the historian 142 could represent a component that stores various information about the system 100.
- the historian 142 could, for example, store information used during production scheduling and optimization.
- the historian 142 represents any suitable structure for storing and facilitating retrieval of information. Although shown as a single centralized component coupled to the network 136, the historian 142 could be located elsewhere in the system 100, or multiple historians could be distributed in different locations in the system 100.
- One or more of the devices shown in FIGURE 1 could support a technique for automated certificate enrollment. This allows the one or more devices to obtain public key certificates, such as x.509 certificates, from a certification authority that is previously unknown to the devices. As a result, an owner or operator of the system 100 can obtain the devices from one or more manufactures, vendors, or other organizations, install the devices in the system 100, and allow the devices to obtain the public key certificates from a desired certification authority. Additional details regarding these techniques are provided below.
- FIGURE 1 illustrates one example of an industrial process control and automation system 100
- a control and automation system could include any number of sensors, actuators, controllers, servers, operator stations, networks, and other components.
- the makeup and arrangement of the system 100 in FIGURE 1 is for illustration only. Components could be added, omitted, combined, or placed in any other suitable configuration according to particular needs. Further, particular functions have been described as being performed by particular components of the system 100. This is for illustration only. In general, control and automation systems are highly configurable and can be configured in any suitable manner according to particular needs.
- FIGURE 1 illustrates an example environment in which techniques for automated certificate enrollment can be used. This functionality can be used in any other suitable device or system, and that device or system need not be used for industrial process control and automation.
- FIGURE 2 illustrates an example device 200 supporting a technique for automated certificate enrollment according to this disclosure.
- the device 200 could, for example, represent any of the devices shown in FIGURE 1 and described above. However, the device 200 could represent any other suitable device or system that implements one or more techniques for automated certificate enrollment, whether or not used for industrial process control and automation.
- the device 200 includes at least one processor 202, at least one storage device 204, at least one communications unit 206, and at least one input/output (I/O) unit 208.
- Each processor 202 can execute instructions, such as those that may be loaded into a memory 210.
- Each processor 202 denotes any suitable processing device, such as one or more microprocessors, microcontrollers, central processing units (CPUs), digital signal processors, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or discrete circuitry.
- the memory 210 and a persistent storage 212 are examples of storage devices 204, which represent any structure(s) capable of storing and facilitating retrieval of information (such as data, program code, and/or other suitable information on a temporary or permanent basis).
- the memory 210 may represent a random access memory or any other suitable volatile or non-volatile storage device(s).
- the persistent storage 212 may contain one or more components or devices supporting longer-term storage of data, such as a read only memory (like an EEPROM), hard drive, Flash memory, or optical disc.
- the communications unit 206 supports communications with other systems or devices.
- the communications unit 206 could include at least one network interface card or wireless transceiver facilitating communications over at least one wired or wireless network.
- the communications unit 206 may support communications through any suitable physical or wireless communication link(s).
- the I/O unit 208 allows for input and output of data.
- the I/O unit 208 may provide a connection for user input through a keyboard, mouse, keypad, touchscreen, or other suitable input device.
- the I/O unit 208 may also send output to a display, printer, or other suitable output device. Note, however, that the I/O unit 208 is not required for automated certificate enrollment to work as intended.
- the device 200 could include components supporting sensor functionality, actuator functionality, or controller functionality.
- the device 200 could include one or more components that measure at least one process variable value of an industrial process or one or more components that alter at least one aspect of the industrial process.
- the device 200 could include any suitable components that perform any desired functionality, as long as the device 200 supports automated certificate enrollment.
- FIGURE 2 illustrates one example of a device 200 supporting a technique for automated certificate enrollment
- various changes may be made to FIGURE 2 .
- various components in FIGURE 2 could be combined, further subdivided, or omitted and additional components could be added according to particular needs.
- computing devices and other devices that perform automated certificate enrollment can come in a wide variety of configurations, and FIGURE 2 does not limit this disclosure to any particular configuration of device.
- FIGURE 3 illustrates an example architecture 300 for automated certificate enrollment according to this disclosure.
- the architecture 300 involves the use of a device 302 and a certification authority (CA) node 304.
- the device 302 represents any suitable device configured to engage in automated certificate enrollment, such as the device 200 of FIGURE 2 or any suitable device in the system 100 of FIGURE 1 .
- the CA node 304 represents any suitable device or system configured to function as a certificate authority and to provide x.509 certificates or other key certificates.
- the CA node 304 could include at least one computing device having one or more processors, one or more memories, one or more communications units, and optionally one or more I/O units, such as in the arrangement shown in FIGURE 2 .
- the device 302 in this example includes one or more applications 306 and a certificate management subsystem 308.
- the applications 306 could include any suitable applications supporting any suitable functionality in the device 302.
- the applications 306 could include sensing logic used to sense one or more characteristics of an industrial process, actuation logic used to adjust one or more characteristics of an industrial process, or control logic used to control one or more components of an industrial process control and automation system.
- At least one of the applications 306 could support the use of key certificates, which are obtained by the certificate management subsystem 308.
- the certificate management subsystem 308 controls the enrollment of the device 302 with the CA node 304 and obtains one or more key certificates from the CA node 304.
- the certificate management subsystem 308 includes a certificate manager 310 and multiple clients 312 used to interact with the CA node 304.
- the certificate manager 310 denotes an application or other logic performed by the device 302 to request and use key certificates.
- the clients 312 denote applications or other logic that allows the certificate manager 310 to interact with the CA node 304 using different protocols.
- one or more of the applications 306 can interact with the certificate manager 310 using an Application Programming Interface (API), and the certificate manager 310 can respond to the application(s) 306 in the form of one or more callbacks.
- API Application Programming Interface
- an application 306 can invoke functions of the certificate manager 310 via the API, such as by sending a request for the certificate manager 310 to obtain a key certificate from the CA node 304.
- the certificate manager 310 can obtain the key certificate using one or more of die clients 312 and return the key certificate to the application 306 using a callback.
- the clients 312 support the use of a Simple Certificate Enrollment Protocol (SCEP) and an Enrollment over Secure Transport (EST) protocol.
- SCEP Simple Certificate Enrollment Protocol
- EST Enrollment over Secure Transport
- the SCEP client 312 can interact with the CA node 304 by sending a certificate retrieval command (GetCRL) to the CA node 304, and the CA node 304 can respond by returning the appropriate certificate to the SCEP client 312.
- the EST client 312 can interact with the CA node 304 by sending certificate enrollment (Enroll) and renewal (Renew) commands to the CA node 304, and the CA node 304 can respond by returning the appropriate certificate to the EST client 312.
- any other or additional protocol(s) could be supported by the certificate management subsystem 308, and the certificate management subsystem 308 need not support both SCEP and EST.
- the clients 312 could be implemented using security technology from MOCANA CORP.
- the CA node 304 denotes a certification authority used by a customer or other entity that is attempting to register the device 302.
- the CA node 304 is different from a device manufacturer's CA node 320.
- the device manufacturer can set up the CA node 320 and, for each device 302 that is manufactured, the CA node 320 can provide a device certificate signed by the CA node 320 to the device 302.
- the manufacturer's device certificates are used later for certificate provisioning by the CA node 304.
- the CA node 320 could include one or more processors, one or more memories, one or more communications units, and optionally one or more I/O units, such as in the arrangement shown in FIGURE 2 .
- the CA node 304 in this example includes multiple servers 314, which support interactions with various devices (including the device 302) to provide key certificates using multiple protocols. Again, the SCEP and EST protocols are shown here. However, any other or additional protocol(s) could also be supported, and the CA node 304 need not support both SCEP and EST.
- An authorizer 316 denotes an application or other logic that interacts with the device 302, a certificate authority 318, and the manufacturer's CA node 320 in order to provide key certificates to devices, including the device 302.
- the authorizer 316 can be used to verify a one-time password sent by the device 302 if the device 302 is able to provide the password. If not (such as for the reasons described above), the authorizer 316 can verify a serial number or other identifier sent by the device 302 as part of the manufacturer's device certificate or otherwise obtained against a whitelist (which can be maintained by the certificate authority 318).
- the certificate authority 318 denotes an application or other logic that generates and provides key certificates to devices, including the device 302. If approved, the authorizer 316 allows the device 302 to interact with the certificate authority 318 in order to obtain a key certificate from the certificate authority 318.
- the authorizer 316 supports various functions, including a pre-authorization function and a third-party import function. These functions can be used to identify devices that are allowed to receive key certificates from the CA node 304.
- the certificate authority 318 also supports various functions, including an administration function and a revocation function. These functions can be used to control and revoke the key certificates issued by the certificate authority 318.
- FIGURE 3 illustrates one example of an architecture 300 for automated certificate enrollment
- various changes may be made to FIGURE 3 .
- various components in FIGURE 3 could be combined, further subdivided, or omitted and additional components could be added according to particular needs.
- any other or additional protocols could be supported in FIGURE 3 .
- FIGURE 4 illustrates additional details of an example device 302 that supports automated certificate enrollment according to this disclosure.
- the device 302 includes a memory 402, which could denote any of the storage devices 204 in FIGURE 2 .
- the memory 402 stores various information, including at least one manufacturer's device certificate 404 and at least one site application certificate 406.
- the device certificate 404 could represent a certificate provided by the device manufacturer's CA node 320, such as during manufacture of the device 302. Note, however, that the device certificate 404 could be provided at other times and by other entities.
- the device certificate 404 can be provided by an entity using a trusted authority at a time when the device 302 is known to be secure.
- the site application certificate 406 can denote a certificate that is obtained by the device 302 from the customer's CA node 304.
- the memory 402 in this example also stores other data used, generated, or collected by the device 302.
- enrollment information 408 can include information used by the certificate manager 310 to enroll with or otherwise receive key certificates from one or more of the CA nodes 304 and 320.
- Transport Layer Security (TLS) server profiles 410 can include information used by the device 302 to engage in secure communications with the CA nodes 304 and 320 or other components over a network.
- One or more certificate revocation lists (CRLs) 412 can include information identifying key certificates that have been revoked and are no longer valid.
- Registered application information 414 can include information identifying applications of the device 302 that are allowed to request key certificates.
- Environment information 416 can include information associated with the operational environment in which the device 302 operates, which can be used (among other things) when creating secure communication sessions with the device 302. Any other or additional information associated with the device 302 could be stored in the memory 402.
- the device 302 also includes a Transport Layer Security (TLS) server toolkit 418, which provides various functions used to secure communications involving the device 302.
- the toolkit 418 includes a TLS server 420, which is able to create or accept encrypted connections via TLS or Secure Sockets Layer (SSL).
- a cryptographic generator 422 generates data, such as true random number generator (TRNG) values or Elliptic-curve Diffie-Hellman (ECDH) shared secrets, that are used by the toolkit 418.
- the cryptographic generator 422 could represent a cryptographic IP core from SILEX INSIDE (previously BARCO-SILEX).
- a cryptographic chip 424 represents an integrated circuit chip that securely performs cryptographic operations, such as digital signature generation and verification, in order to provide secure authentication.
- the cryptographic chip 424 could represent an ATMEL cryptographic chip from MICROCHIP TECHNOLOGY INC.
- a key manager 426 supports the generation and retrieval of encryption keys, which can be used to (among other things) create and engage in secure communication sessions.
- the exact implementation of the TLS toolkit 418 here relates to a specific hardware implementation, and various other implementations are possible. It is also possible to omit the TLS toolkit 418 or use other mechanisms for securing communications.
- the device 302 may further include a communication module 428 and a redundancy module 430.
- the communication module 428 supports communications involving various components of the device 302, such as by allowing device configurations or other data to be loaded onto the device 302.
- the communication module 428 can support communications over any suitable buses or other communication links.
- the redundancy module 430 in one device 302 can communicate with the redundancy module 430 in another device 302 so that the devices 302 can exchange data and remain generally synchronized with one another.
- This allows multiple devices 302 to function as redundant partners in order to increase availability of at least one of the devices 302. This is common in industrial control systems, where redundant devices are used as sensors, actuators, controllers, or other components to help ensure that a failure of one device does not result in a loss of view or control over an industrial process. Note, however, that the redundancy module 430 can be omitted if redundancy is not needed or desired with the device 302.
- FIGURE 4 illustrates additional details of an example device 302 that supports automated certificate enrollment
- various changes may be made to FIGURE 4 .
- SCEP and EST any other or additional protocol(s) could be supported by the device 302.
- TLS any other or additional mechanism(s) can be used to support secure communications with the device 302.
- FIGURE 5 illustrates an example method 500 for storing a device certificate associated with a manufacturer in a device in accordance with this disclosure.
- the method 500 is described as being performed using die device 302 and the CA node 320.
- the method 500 could be used by any suitable device and in any suitable system.
- a manufacturer of the devices 302 uses its CA node 320 to store a device certificate 404 in each device 302.
- the device certificate 404 is signed by the manufacturer's CA node 320 and can be used for certificate provisioning with the customer's certificate authority 318 implemented by the customer's CA node 304.
- the device certificate 404 needs to be trusted by the customer's certificate authority 318.
- a device generates a first public key-private key pair at step 502. This could include, for example, the device 302 using its cryptographic chip or processor to generate a first pair of cryptographic keys, including a first public key (denoted PK1) and a first private or secret key (denoted SKI).
- the device prepares a first certificate signing request using the first public key-private key pair at step 504. This could include, for example, the device 302 using its cryptographic chip or processor to generate a first certificate signing request (denoted CSR1) using the first public key PK1 and the first private or secret key SK1.
- the first certificate signing request CSR1 requests that a certification authority issue a public key certificate for the device 302, where the public key certificate identifies the device 302 as the owner of the first public key PK1.
- the device sends the first certificate signing request to a trusted certification authority at step 506.
- a trusted certification authority at step 506.
- the trusted certification authority issues a first device certificate for the device based on the first certificate signing request at step 508.
- This could also include the CA node 320 using its cryptographic chip or processor to generate a first device certificate (denoted Cert1) based on at least some of the contents of the first certificate signing request CSR1.
- the trusted certification authority sends the first device certificate to the device at step 510.
- the device stores the first device certificate at step 512.
- the method 500 shown in FIGURE 5 operates based on the fact that the device manufacturer's CA node 320 trusts the device 302 that is being manufactured since the environment in which the device 302 is manufactured is under the device manufacturer's control. Hence, there is no need to authenticate the device 302 towards the CA node 320.
- the method 500 here could be repeated for each device 302 that is being manufactured.
- FIGURE 5 illustrates one example of a method 500 for storing a device certificate 404 associated with a manufacturer in a device 302
- various changes may be made to FIGURE 5 .
- steps in FIGURE 5 could overlap, occur in parallel, occur in a different order, or occur any number of times.
- the method 500 is described as being used by a manufacturer of the device 302, the method 500 could be used by other parties associated with the device 302 (such as trusted vendors or other parties).
- FIGURES 6 and 7 illustrate example methods 600 and 700 for automated certificate enrollment for devices in industrial control systems or other systems according to this disclosure.
- the methods 600 and 700 are described as being performed using the device 302 and the CA node 304.
- the methods 600 and 700 could be used by any suitable device and in any suitable system.
- the method 600 is used for automated device enrollment in order to provision a device 302 that is being installed at a customer's site.
- the device 302 obtains an additional device certificate that is issued by the customer's own certificate authority 318 in the customer CA node 304, rather than from the device manufacturer's CA node 304.
- a customer certification authority obtains a trusted certificate for a trusted certification authority at step 602.
- This digital certificate enables the CA node 304 to verify whether devices 302 contain valid device certificates 404 issued by the CA node 320. Note that this step may need to be performed only once per device manufacturer, regardless of the number of devices 302 from that device manufacturer that request key certificates.
- a device generates a second public key-private key pair at step 604.
- the device prepares a second certificate signing request using the second public key-private key pair at step 606.
- the second certificate signing request CSR2 requests that a certification authority issue a public key certificate for the device 302, where the public key certificate identifies the device 302 as the owner ofthe second public key PK2.
- the device signs the second certificate signing request using its first private key at step 608.
- the device sends the second certificate signing request along with its first device certificate to the customer certification authority at step 610.
- the customer certification authority uses the trusted certificate to verify the first device certificate at step 612. This could include, for example, the CA node 304 using its cryptographic chip or processor to determine whether the first device certificate Cert1 received from the device 302 was digitally signed by the CA node 320. If so, this provides an indication that the device 302 comes from a valid (non-counterfeit) source.
- the customer certification authority uses the first device certificate to verify the signature of the second certificate signing request at step 614. This could include, for example, the CA node 304 using its cryptographic chip or processor to determine whether the second certificate signing request CSR2 was signed by the first private or secret key SK1 of the device 302. If so, this provides an indication that the second certificate signing request CSR2 comes from a valid device 302.
- the customer certification authority issues a second device certificate for the device using the second certificate signing request at step 616.
- the customer certification authority sends the second device certificate to the device at step 618.
- the device stores the second device certificate at step 620.
- the device 302 has a certificate 406 that has been issued by the customer's own CA node 304.
- the certificate 406 can then be used in various security protocols with other peers that trust the customer's certificate authority 318.
- the device 302 is able to obtain one or more key certificates 406 in addition to the device certificate 404 issued by the device manufacturer.
- the method 600 shown in FIGURE 6 provides for full automation of the device certificate provisioning with the customer's certificate authority 318.
- the customer's certificate authority 318 there might be a security requirement that requires the customer's certificate authority 318 to issue device certificates only to approved devices.
- this could be supported in the architecture 300 of FIGURE 3 .
- One way to support this is through the use of device passwords, but this can be problematic as described above.
- each device certificate 404 issued by the manufacturer's CA node 320 could contain a unique identifier, such as a device serial number, medium access control (MAC) address, or Internet Protocol (IP) address.
- the unique identifiers could be identified by the CA node 304 using the manufacturer's device certificates 404. If the serial number or other unique identifier is visible on the device 302 or otherwise obtainable, the unique identifier could also be entered into the whitelist of the CA node 304, such as by personnel typing or scanning the unique identifier.
- the unique identifier for each device 302 is added to the whitelist before the device 302 attempts to enroll with the customer's CA node 304 and receive a certificate 406 from the CA node 304.
- the customer's certificate authority 318 will be able to verify whether a device certificate 404 signed by die manufacturer's CA node 320 contains a whitelisted identifier and, if so, provide a certificate 406 to the device 302.
- other cryptographic mechanisms such as raw public keys, could also be used to obtain validation of unique identifiers against the whitelist.
- the method 700 is used for automated device enrollment in order to provision a device 302 that is being installed at a customer's site.
- the device 302 obtains an additional device certificate that is issued by the customer's own certificate authority 318 in the customer CA node 304, rather than from the device manufacturer's CA node 304.
- the customer's certificate authority 318 can verify that the device 302 is whitelisted prior to issuing the additional device certificate to the device 302.
- a customer certification authority obtains a trusted certificate for a trusted certification authority at step 702.
- This digital certificate enables the CA node 304 to verify whether devices 302 contain valid device certificates 404 issued by the CA node 320. Note that this step may need to be performed only once per device manufacturer, regardless of the number of devices 302 from that device manufacturer that request key certificates.
- the customer certification authority obtains one or more unique identifiers for a whitelist at step 704.
- This could include, for example, the customer's CA node 304 using its communications unit or I/O unit to obtain one or more unique identifiers (such as serial numbers, MAC addresses, or IP addresses).
- the unique identifiers identify the devices 302 that are authorized to register with the customer's CA node 304 and obtain certificates 406 from the CA node 304.
- the unique identifiers could be entered manually, such as when a user types an identifier into the CA node 304 or manually scans an optical code on a device 302.
- the unique identifiers could be obtained automatically, such as when the manufacturer's CA node 320 transmits device certificates 404 or unique identifiers to the CA node 304 for devices 302 being provided to the customer.
- a device generates a second public key-private key pair at step 706.
- This could include, for example, the device 302 using its cryptographic chip or processor to generate a second pair of cryptographic keys, including a second public key PK2 and a second private or secret key SK2.
- the device prepares a second certificate signing request using the second public key-private key pair at step 708.
- This could include, for example, the device 302 using its cryptographic chip or processor to generate a second certificate signing request CSR2 using the second public key PK2 and the second private or secret key SK2.
- the second certificate signing request CSR2 requests that a certification authority issue a public key certificate for the device 302, where the public key certificate identifies the device 302 as the owner of the second public key PK2.
- the device signs the second certificate signing request using its first private key at step 710. This could include, for example, the device 302 using its cryptographic chip or processor to digitally sign the second certificate signing request CSR2 using the device's first private or secret key SK1.
- the device sends the second certificate signing request along with its first device certificate to the customer certification authority at step 712. This could include, for example, the device 302 using its communications unit to transmit the second certificate signing request CSR2 and the first device certificate Cert1 (device certificate 404 from the memory 402) to the customer's CA node 304.
- the customer certification authority uses the trusted certificate to verify the first device certificate at step 714. This could include, for example, the CA node 304 using its cryptographic chip or processor to determine whether the first device certificate Cert1 received from the device 302 was digitally signed by the CA node 320. If so, this provides an indication that the device 302 comes from a valid (non-counterfeit) source.
- the customer certification authority verifies that the device's unique identifier is contained in the whitelist at step 716. This could include, for example, the CA node 304 using its cryptographic chip or processor to determine whether the unique identifier of the device 302 contained in the first device certificate Cert1 was previously provided to the CA node 304 and is listed in the whitelist of the CA node 304.
- this provides an indication that the device 302 has been previously authorized to register with the CA node 304 and receive a certificate 406.
- the customer certification authority uses the first device certificate to verify the signature of the second certificate signing request at step 718. This could include, for example, the CA node 304 using its cryptographic chip or processor to determine whether the second certificate signing request CSR2 was signed by the first private or secret key SK1 of the device 302. If so, this provides an indication that the second certificate signing request CSR2 comes from a valid device 302.
- the customer certification authority issues a second device certificate for the device using the second certificate signing request at step 720.
- the customer certification authority sends the second device certificate to the device at step 722.
- the device stores the second device certificate at step 724.
- the device 302 has a certificate 406 that has been issued by the customer's own CA node 304 after the customer's CA node 304 has verified that the device 302 is allowed to be authorized.
- the certificate 406 can then be used in various security protocols with other peers that trust the customer's certificate authority 318.
- the device 302 is able to obtain one or more key certificates 406 in addition to the device certificate 404 issued by the device manufacturer.
- the automated device enrollment technique of FIGURE 7 does not require any secure channel to the device 302. This is because the actual insertion of the unique identifier into the customer certification authority's whitelist can be done outside the device network in the customer's trusted zone.
- FIGURES 6 and 7 illustrate examples of methods 600 and 700 for automated certificate enrollment for devices in industrial control systems or other systems
- various changes may be made to FIGURES 6 and 7 .
- each method is shown as a series of steps, various steps in each method could overlap, occur in parallel, occur in a different order, or occur any number of times.
- various cryptographic mechanisms can be used for communication and verification in the methods 600 and 700.
- the device 302 can sign its certificate signing requests in any suitable manner, such as when the certificate signing requests are signed using a private key without a corresponding certificate or other cryptographic mechanisms.
- various functions described in this patent document are implemented or supported by a computer program that is formed from computer readable program code and that is embodied in a computer readable medium.
- computer readable program code includes any type of computer code, including source code, object code, and executable code.
- computer readable medium includes any type of medium capable of being accessed by a computer, such as read only memory (ROM), random access memory (RAM), a hard disk drive, a compact disc (CD), a digital video disc (DVD), or any other type of memory.
- ROM read only memory
- RAM random access memory
- CD compact disc
- DVD digital video disc
- a “non-transitory” computer readable medium excludes wired, wireless, optical, or other communication links that transport transitory electrical or other signals.
- a non-transitory computer readable medium includes media where data can be permanently stored and media where data can be stored and later overwritten, such as a rewritable optical disc or an erasable storage device.
- application and “program” refer to one or more computer programs, software components, sets of instructions, procedures, functions, objects, classes, instances, related data, or a portion thereof adapted for implementation in a suitable computer code (including source code, object code, or executable code).
- program refers to one or more computer programs, software components, sets of instructions, procedures, functions, objects, classes, instances, related data, or a portion thereof adapted for implementation in a suitable computer code (including source code, object code, or executable code).
- communicate as well as derivatives thereof, encompasses both direct and indirect communication.
- the term “or” is inclusive, meaning and/or.
- phrases "associated with,” as well as derivatives thereof, may mean to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, have a relationship to or with, or the like.
- the phrase "at least one of,” when used with a list of items, means that different combinations of one or more of the listed items may be used, and only one item in the list may be needed. For example, "at least one of: A, B, and C" includes any of the following combinations: A, B, C, A and B, A and C, B and C, and A and B and C.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Medical Informatics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
- Storage Device Security (AREA)
Claims (14)
- Verfahren, umfassend:Empfangen (610, 712), von einer Vorrichtung (302), (i) einer Zertifikatsanforderung für eine Zertifizierungsstelle (304) und (ii) eines ersten digitalen Zertifikats (404), wobei die Zertifikatsanforderung von der Vorrichtung (302) digital signiert ist, und das erste digitale Zertifikat (404) in der Vorrichtung (302) gespeichert ist;Verifizieren (612, 714), bei der Zertifizierungsstelle (304), des ersten digitalen Zertifikats (404) mittels eines zweiten digitalen Zertifikats einer anderen Zertifizierungsstelle (320);Verifizieren (614, 718), bei der Zertifizierungsstelle (304), der digitalen Signatur der digital signierten Zertifikatsanforderung mittels des ersten digitalen Zertifikats (404); undnach dem Verifizieren des ersten digitalen Zertifikats und der digitalen Signatur, Übertragen (618, 722), durch die Zertifizierungsstelle (304), eines zweiten digitalen Zertifikats (406) an die Vorrichtung (302),wobei:das erste digitale Zertifikat (404) ein digitales Zertifikat umfasst, das von der anderen Zertifizierungsstelle (320) ausgestellt wird, die einem Hersteller der Vorrichtung zugeordnet ist; unddas zweite digitale Zertifikat (406) ein digitales Zertifikat umfasst, das von der Zertifizierungsstelle (304) ausgestellt wird, das einem Kunden zugeordnet ist, der die Vorrichtung installiert oder verwendet.
- Verfahren nach Anspruch 1, ferner umfassend:Erhalten (712) einer eindeutigen Kennung, die der Vorrichtung zugeordnet ist; undBestimmen (716), ob die eindeutige Kennung in einer Whitelist der Zertifizierungsstelle enthalten ist;wobei das zweite digitale Zertifikat an die Vorrichtung übertragen wird, nach dem Bestimmen, dass die eindeutige Kennung in der Whitelist enthalten ist.
- Verfahren nach Anspruch 2, ferner umfassend:Empfangen (704) mehrerer eindeutiger Kennungen; undPlatzieren (704) der mehreren eindeutigen Kennungen in der Whitelist.
- Verfahren gemäß Anspruch 2, wobei:
die eindeutige Kennung mindestens eines umfasst von: einer Seriennummer und einer Internetprotokoll (IP)-Adresse der Vorrichtung. - Gerät, das dazu konfiguriert ist, eine Zertifizierungsstelle (304) bereitzustellen, wobei das Gerät umfasst:
mindestens einen Prozessor (202), der dazu konfiguriert ist:von einer Vorrichtung (302) (i) eine Zertifikatsanforderung für die Zertifizierungsstelle und (ii) ein erstes digitales Zertifikat (404) zu empfangen, wobei die Zertifikatsanforderung von der Vorrichtung (302) digital signiert ist, und das erste digitale Zertifikat (404) in der Vorrichtung; Vorrichtung (302) gespeichert ist;das erste digitale Zertifikat (404) unter Verwendung eines zweiten digitalen Zertifikats (406) einer anderen Zertifizierungsstelle (320) zu verifizieren;die digitale Signatur der digital signierten Zertifikatsanforderung unter Verwendung des ersten digitalen Zertifikats zu verifizieren;
undnach dem Verifizieren des ersten digitalen Zertifikats und der digitalen Signatur die Übertragung eines zweiten digitalen Zertifikats (406) an die Vorrichtung (302) zu initiieren,wobei:das erste digitale Zertifikat (404) ein digitales Zertifikat umfasst, das von der anderen Zertifizierungsstelle (320) ausgestellt wird, die einem Hersteller der Vorrichtung zugeordnet ist; unddas zweite digitale Zertifikat (406) ein digitales Zertifikat umfasst, das von der Zertifizierungsstelle (304) ausgestellt wird, das einem Kunden zugeordnet ist, der die Vorrichtung installiert oder verwendet. - Gerät nach Anspruch 5, wobei:der mindestens eine Prozessor ferner dazu konfiguriert ist:eine eindeutige Kennung zu erhalten, die der Vorrichtung zugeordnet ist; undzu bestimmen, ob die eindeutige Kennung in einer Whitelist der Zertifizierungsstelle enthalten ist; undder mindestens eine Prozessor dazu konfiguriert ist, die Übertragung des zweiten digitalen Zertifikats an die Vorrichtung zu initiieren, nach dem Bestimmen, dass die eindeutige Kennung in der Whitelist enthalten ist.
- Gerät nach Anspruch 5, wobei der mindestens eine Prozessor ferner dazu konfiguriert ist:mehrere eindeutige Kennungen zu empfangen; unddie mehreren eindeutigen Kennungen in der Whitelist zu platzieren.
- Gerät nach Anspruch 7, wobei:
die eindeutige Kennung mindestens eines umfasst von: einer Seriennummer und einer Internetprotokoll (IP)-Adresse der Vorrichtung. - Verfahren, umfassend:Erzeugen (604, 706), durch mindestens einen Prozessor (202) einer Vorrichtung (302), eines Schlüsselpaares, das einen ersten und zweiten Schlüssel aufweist, das der Vorrichtung (302) zugeordnet istErzeugen (606, 708) einer dem Schlüsselpaar zugeordneten Zertifikatsanforderung an der Vorrichtung (302):digitales Signieren (608, 710) der Zertifikatsanforderung durch den mindestens einen Prozessor (202) der Vorrichtung (302);Übertragen (610, 712), durch eine Kommunikationseinheit (206) der Vorrichtung, der Zertifikatsanforderung und eines ersten in der Vorrichtung gespeicherten digitalen Zertifikats (404) an eine Zertifizierungsstelle (304); undals Reaktion auf das Verifizieren des ersten digitalen Zertifikats und der digitalen Signatur der digital signierten Zertifikatsanforderung durch die Zertifizierungsstelle, Empfangen (620, 724) eines zweiten digitalen Zertifikats (406) von der Zertifizierungsstelle und Speichern (620, 724) des zweiten digitalen Zertifikats in der Vorrichtung,wobei:das erste digitale Zertifikat (404) ein digitales Zertifikat umfasst, das von einer anderen Zertifizierungsstelle (320) ausgestellt wird, die einem Hersteller der Vorrichtung zugeordnet ist; unddas zweite digitale Zertifikat (406) ein digitales Zertifikat umfasst, das von der Zertifizierungsstelle (304) während der Installation der Vorrichtung in einem System (100) ausgestellt wird.
- Verfahren gemäß Anspruch 9, wobei:die Zertifikatsanforderung mit einem dritten Schlüssel digital signiert wird; undder dritte Schlüssel einen privaten oder geheimen Schlüssel umfasst, der dem ersten digitalen Zertifikat zugeordnet ist.
- Verfahren nach Anspruch 9, wobei das zweite digitale Zertifikat von der Zertifizierungsstelle empfangen wird.
- Gerät (302), umfassend:mindestens einen Speicher (204, 210, 212, 402), der konfiguriert ist zum Speichern eines ersten digitalen Zertifikats (404);
undmindestens einen Prozessor (202), der dazu konfiguriert ist:ein Schlüsselpaar zu erzeugen, das einen ersten und zweiten Schlüssel aufweist, das dem Gerät zugeordnet ist;eine Zertifikatsanforderung zu erzeugen, die dem Schlüsselpaar zugeordnet ist;die Zertifikatsanforderung digital zu signieren;die Übertragung der Zertifikatsanforderung und des ersten digitalen Zertifikats an eine Zertifizierungsstelle (304) zu initiieren; undals Reaktion auf das Verifizieren des ersten digitalen Zertifikats und der digitalen Signatur der digital signierten Zertifikatsanforderung durch die Zertifizierungsstelle, ein zweites digitales Zertifikat (406) von der Zertifizierungsstelle (304) zu empfangen und das zweite digitale Zertifikat in dem mindestens einen Speicher zu speichern.wobei:das erste digitale Zertifikat (404) ein digitales Zertifikat umfasst, das von einer anderen Zertifizierungsstelle (320) ausgestellt wird, die einem Hersteller der Vorrichtung zugeordnet ist; unddas zweite digitale Zertifikat (406) ein digitales Zertifikat umfasst, das von der Zertifizierungsstelle (304) während der Installation der Vorrichtung in einem System (100) ausgestellt wird. - Gerät nach Anspruch 12, wobei:der mindestens eine Prozessor dazu konfiguriert ist, die Zertifikatsanforderung mittels eines dritten Schlüssels digital zu signieren; undder dritte Schlüssel einen privaten oder geheimen Schlüssel umfasst, der dem ersten digitalen Zertifikat zugeordnet ist.
- Gerät nach Anspruch 12, wobei der mindestens eine Prozessor dazu konfiguriert ist, das zweite digitale Zertifikat von der Zertifizierungsstelle zu empfangen.
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201762501846P | 2017-05-05 | 2017-05-05 | |
US15/891,095 US10749692B2 (en) | 2017-05-05 | 2018-02-07 | Automated certificate enrollment for devices in industrial control systems or other systems |
PCT/US2018/030608 WO2018204471A1 (en) | 2017-05-05 | 2018-05-02 | Automated certificate enrollment for devices in industrial control systems or other systems |
Publications (3)
Publication Number | Publication Date |
---|---|
EP3619888A1 EP3619888A1 (de) | 2020-03-11 |
EP3619888A4 EP3619888A4 (de) | 2020-12-23 |
EP3619888B1 true EP3619888B1 (de) | 2024-04-24 |
Family
ID=64015545
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP18794197.6A Active EP3619888B1 (de) | 2017-05-05 | 2018-05-02 | Automatisierte zertifikatsregistrierung für vorrichtungen in industriereglerystemen oder anderen systemen |
Country Status (5)
Country | Link |
---|---|
US (1) | US10749692B2 (de) |
EP (1) | EP3619888B1 (de) |
CN (1) | CN110546917A (de) |
AU (1) | AU2018261368A1 (de) |
WO (1) | WO2018204471A1 (de) |
Families Citing this family (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11456882B2 (en) | 2010-04-30 | 2022-09-27 | T-Central, Inc. | Using PKI for security and authentication of control devices and their data |
US11743057B2 (en) | 2010-04-30 | 2023-08-29 | T-Central, Inc. | Using PKI for security and authentication of control devices and their data |
US10153908B2 (en) | 2010-04-30 | 2018-12-11 | T-Central, Inc. | Secure communication of IOT devices for vehicles |
US10652031B2 (en) * | 2010-04-30 | 2020-05-12 | T-Central, Inc. | Using PKI for security and authentication of control devices and their data |
CN109982150B (zh) * | 2017-12-27 | 2020-06-23 | 国家新闻出版广电总局广播科学研究院 | 智能电视终端的信任链建立方法和智能电视终端 |
US11496322B2 (en) | 2018-05-21 | 2022-11-08 | Entrust, Inc. | Identity management for software components using one-time use credential and dynamically created identity credential |
EP3585027B1 (de) * | 2018-06-20 | 2021-11-03 | Siemens Aktiengesellschaft | Verfahren zur anbindung eines endgerätes an eine vernetzbare rechner-infrastruktur |
US10439825B1 (en) * | 2018-11-13 | 2019-10-08 | INTEGRITY Security Services, Inc. | Providing quality of service for certificate management systems |
US20200259847A1 (en) * | 2019-02-08 | 2020-08-13 | Fortinet, Inc. | Providing secure data-replication between a master node and tenant nodes of a multi-tenancy architecture |
EP3700160A1 (de) * | 2019-02-25 | 2020-08-26 | CODESYS Holding GmbH | Kryptographische zertifikate für ein industrielles steuergerät |
EP3734902A1 (de) * | 2019-04-29 | 2020-11-04 | Siemens Aktiengesellschaft | Verfahren und system zur vergabe von öffentlich getrusteten zertifikaten, engineering- oder leitsystem und technische anlage |
US11139989B2 (en) * | 2019-08-30 | 2021-10-05 | Motorola Solutions, Inc. | Method of enrolling a device into a PKI domain for certificate management using factory key provisioning |
CN114788219A (zh) * | 2019-09-16 | 2022-07-22 | 诺得技术公司 | 供应和验证设备证书 |
EP3851923B1 (de) * | 2020-01-14 | 2023-07-12 | Siemens Aktiengesellschaft | Leitsystem für technische anlagen mit zertifikatsmanagement |
US11237534B2 (en) * | 2020-02-11 | 2022-02-01 | Honeywell International Inc. | Managing certificates in a building management system |
US20220006654A1 (en) * | 2020-07-02 | 2022-01-06 | EMC IP Holding Company LLC | Method to establish an application level ssl certificate hierarchy between master node and capacity nodes based on hardware level certificate hierarchy |
EP3952201A1 (de) * | 2020-08-07 | 2022-02-09 | ABB Schweiz AG | Vertrauensbildung durch zertifikatsverwaltung in open platform communications unified architecture |
EP3985532B1 (de) * | 2020-10-19 | 2023-02-22 | Siemens Aktiengesellschaft | Zertifikatsmanagement für technische anlagen |
US20230015789A1 (en) * | 2021-07-08 | 2023-01-19 | Vmware, Inc. | Aggregation of user authorizations from different providers in a hybrid cloud environment |
EP4412153A1 (de) * | 2023-01-31 | 2024-08-07 | Siemens Aktiengesellschaft | Verfahren und endgerät zur kryptographisch gesicherten übermittlung von daten innerhalb eines kommunikationssystems |
Family Cites Families (140)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE69306389T2 (de) | 1992-06-12 | 1997-06-26 | Dow Chemical Co | Intelligentes prozesssteuerverbindungssystem und verfahren. |
US5371794A (en) | 1993-11-02 | 1994-12-06 | Sun Microsystems, Inc. | Method and apparatus for privacy and authentication in wireless networks |
JPH0865728A (ja) | 1994-08-24 | 1996-03-08 | Hitachi Ltd | 移動体通信ネットワークおよび呼制御方法 |
US7165174B1 (en) | 1995-02-13 | 2007-01-16 | Intertrust Technologies Corp. | Trusted infrastructure support systems, methods and techniques for secure electronic commerce transaction and rights management |
DE19547468C1 (de) | 1995-12-19 | 1997-05-22 | Siemens Ag | Verfahren zur Übertragung von Informationen in einem universellen Übertragungsnetz |
US6560656B1 (en) | 1998-02-26 | 2003-05-06 | Sun Microsystems, Inc. | Apparatus and method for providing downloadable code for use in communicating with a device in a distributed system |
US6901509B1 (en) | 1996-05-14 | 2005-05-31 | Tumbleweed Communications Corp. | Apparatus and method for demonstrating and confirming the status of a digital certificates and other data |
JPH11243584A (ja) | 1998-02-26 | 1999-09-07 | Fujitsu Ltd | 移動通信システムの緊急呼制御装置 |
US6243695B1 (en) | 1998-03-18 | 2001-06-05 | Motorola, Inc. | Access control system and method therefor |
US6427071B1 (en) | 1998-12-08 | 2002-07-30 | At&T Wireless Services, Inc. | Apparatus and method for providing transporting for a control signal |
US6856627B2 (en) | 1999-01-15 | 2005-02-15 | Cisco Technology, Inc. | Method for routing information over a network |
US7174564B1 (en) | 1999-09-03 | 2007-02-06 | Intel Corporation | Secure wireless local area network |
US6990379B2 (en) | 1999-12-30 | 2006-01-24 | Microsoft Corporation | Method and apparatus for providing a dynamic resource role model for subscriber-requester based protocols in a home automation and control system |
US6631416B2 (en) | 2000-04-12 | 2003-10-07 | Openreach Inc. | Methods and systems for enabling a tunnel between two computers on a network |
US7069580B1 (en) | 2000-06-16 | 2006-06-27 | Fisher-Rosemount Systems, Inc. | Function-based process control verification and security in a process control system |
JP4410921B2 (ja) | 2000-09-22 | 2010-02-10 | 富士通株式会社 | 回線再配置方法およびそのための回路 |
EP1352496A2 (de) | 2000-10-26 | 2003-10-15 | General Instrument Corporation | Anfängliche kostenlose vorschau von multicast-multimediadaten |
US7472269B2 (en) | 2001-02-23 | 2008-12-30 | Nokia Siemens Networks Oy | System and method for strong authentication achieved in a single round trip |
US20020146127A1 (en) | 2001-04-05 | 2002-10-10 | Marcus Wong | System and method for providing secure communications between wireless units using a common key |
US7035937B2 (en) | 2001-04-25 | 2006-04-25 | Cornell Research Foundation, Inc. | Independent-tree ad hoc multicast routing |
US7016499B2 (en) | 2001-06-13 | 2006-03-21 | Sun Microsystems, Inc. | Secure ephemeral decryptability |
US20030088650A1 (en) | 2001-07-30 | 2003-05-08 | Lockheed Martin Corporation | Using a diskless client network topology for disk duplication and configuration |
US20030061481A1 (en) | 2001-09-26 | 2003-03-27 | David Levine | Secure broadcast system and method |
US7352868B2 (en) | 2001-10-09 | 2008-04-01 | Philip Hawkes | Method and apparatus for security in a data processing system |
US20030151513A1 (en) | 2002-01-10 | 2003-08-14 | Falk Herrmann | Self-organizing hierarchical wireless network for surveillance and control |
US7240366B2 (en) | 2002-05-17 | 2007-07-03 | Microsoft Corporation | End-to-end authentication of session initiation protocol messages using certificates |
US7212837B1 (en) | 2002-05-24 | 2007-05-01 | Airespace, Inc. | Method and system for hierarchical processing of protocol information in a wireless LAN |
AU2003240171A1 (en) | 2002-07-15 | 2004-02-02 | Nokia Corporation | An ipv6 address ownership authentification based on zero-knowledge identification protocols or based on one time password |
US20040015262A1 (en) | 2002-07-18 | 2004-01-22 | International Business Machines Corporation | Method for controlling access to devices in a pervasive embedded environment |
CN1487750A (zh) | 2002-09-30 | 2004-04-07 | 北京三星通信技术研究有限公司 | 多媒体广播与组播业务中密码的管理及分发方法 |
US20040153171A1 (en) | 2002-10-21 | 2004-08-05 | Brandt David D. | System and methodology providing automation security architecture in an industrial controller environment |
US7707406B2 (en) | 2002-11-08 | 2010-04-27 | General Instrument Corporation | Certificate renewal in a certificate authority infrastructure |
US7574509B2 (en) | 2002-11-25 | 2009-08-11 | Fisher-Rosemount Systems, Inc. | Interactive two-way collaboration in process control plants |
US7263357B2 (en) | 2003-01-14 | 2007-08-28 | Samsung Electronics Co., Ltd. | Method for fast roaming in a wireless network |
US7284278B2 (en) | 2003-03-04 | 2007-10-16 | Dell Products L.P. | Secured KVM switch |
US7275157B2 (en) | 2003-05-27 | 2007-09-25 | Cisco Technology, Inc. | Facilitating 802.11 roaming by pre-establishing session keys |
US20040247126A1 (en) | 2003-06-04 | 2004-12-09 | Mcclellan Stanley Archer | Wireless network and methods for communicating in a wireless network |
US6987985B2 (en) | 2003-06-06 | 2006-01-17 | Interdigital Technology Corporation | Wireless communication components and methods for multiple system communications |
US7444508B2 (en) | 2003-06-30 | 2008-10-28 | Nokia Corporation | Method of implementing secure access |
EP2570918A1 (de) | 2003-07-07 | 2013-03-20 | Rovi Solutions Corporation | Neuprogrammierbare Sicherheit zur Raubkopiekontrolle und Aktivierung interaktiven Inhalts |
US7701858B2 (en) | 2003-07-17 | 2010-04-20 | Sensicast Systems | Method and apparatus for wireless communication in a mesh network |
US7835931B2 (en) | 2003-10-03 | 2010-11-16 | Meta Command Systems, Inc. | Method and system for network-based, distributed, real-time command and control of an enterprise |
JP3894181B2 (ja) * | 2003-10-10 | 2007-03-14 | 株式会社日立製作所 | 公開鍵証明書検証の高速化方法、および装置 |
US20050102514A1 (en) | 2003-11-10 | 2005-05-12 | Telefonaktiebolaget Lm Ericsson (Publ) | Method, apparatus and system for pre-establishing secure communication channels |
US7489645B2 (en) | 2003-12-17 | 2009-02-10 | Microsoft Corporation | Mesh networks with end device recognition |
ITTO20031030A1 (it) | 2003-12-22 | 2005-06-23 | Proma Srl | Dispositivo di abbattimento per schienali di veicoli. |
RU2329605C2 (ru) | 2004-02-09 | 2008-07-20 | Корпорация "Самсунг Электроникс" | Система распределения ключей и способ ее функционирования |
JP2005286989A (ja) | 2004-03-02 | 2005-10-13 | Ntt Docomo Inc | 通信端末及びアドホックネットワーク経路制御方法 |
US20050201349A1 (en) | 2004-03-15 | 2005-09-15 | Honeywell International Inc. | Redundant wireless node network with coordinated receiver diversity |
US7646872B2 (en) | 2004-04-02 | 2010-01-12 | Research In Motion Limited | Systems and methods to securely generate shared keys |
US7644270B1 (en) * | 2004-05-10 | 2010-01-05 | Sprint Communications Company L.P. | Web services security architecture |
US20050254653A1 (en) | 2004-05-14 | 2005-11-17 | Proxim Corporation | Pre-authentication of mobile clients by sharing a master key among secured authenticators |
US8527752B2 (en) | 2004-06-16 | 2013-09-03 | Dormarke Assets Limited Liability | Graduated authentication in an identity management system |
US7620409B2 (en) | 2004-06-17 | 2009-11-17 | Honeywell International Inc. | Wireless communication system with channel hopping and redundant connectivity |
EP1763946B1 (de) | 2004-06-29 | 2008-11-26 | Koninklijke Philips Electronics N.V. | System und verfahren zur effizienten authentifikation von knoten eines medizinischen drahtlosen ad-hoc-netzwerks |
US8929228B2 (en) | 2004-07-01 | 2015-01-06 | Honeywell International Inc. | Latency controlled redundant routing |
EP1615381A1 (de) | 2004-07-07 | 2006-01-11 | Thomson Multimedia Broadband Belgium | Vorrichtung und Verfahren zur Registrierung in einem drahtlosen lokalen Netzwerk |
US20060059372A1 (en) | 2004-09-10 | 2006-03-16 | International Business Machines Corporation | Integrated circuit chip for encryption and decryption having a secure mechanism for programming on-chip hardware |
US7236477B2 (en) | 2004-10-15 | 2007-06-26 | Motorola, Inc. | Method for performing authenticated handover in a wireless local area network |
US7593527B2 (en) | 2005-01-07 | 2009-09-22 | First Data Corporation | Providing digital signature and public key based on shared knowledge |
US20060153370A1 (en) | 2005-01-07 | 2006-07-13 | Beeson Curtis L | Generating public-private key pair based on user input data |
US8085672B2 (en) | 2005-01-28 | 2011-12-27 | Honeywell International Inc. | Wireless routing implementation |
US7826373B2 (en) | 2005-01-28 | 2010-11-02 | Honeywell International Inc. | Wireless routing systems and methods |
US7933410B2 (en) | 2005-02-16 | 2011-04-26 | Comcast Cable Holdings, Llc | System and method for a variable key ladder |
US20060205386A1 (en) | 2005-03-11 | 2006-09-14 | Lei Yu | Method and apparatus for providing encryption and integrity key set-up |
US20060227729A1 (en) | 2005-04-12 | 2006-10-12 | Honeywell International Inc. | Wireless communication system with collision avoidance protocol |
US20060236408A1 (en) | 2005-04-14 | 2006-10-19 | International Business Machines Corporation | Method and apparatus for device dependent access control for device independent web content |
FI20050491A0 (fi) | 2005-05-09 | 2005-05-09 | Nokia Corp | Järjestelmä varmenteiden toimittamiseksi viestintäjärjestelmässä |
US7848223B2 (en) | 2005-06-03 | 2010-12-07 | Honeywell International Inc. | Redundantly connected wireless sensor networking methods |
US7742394B2 (en) | 2005-06-03 | 2010-06-22 | Honeywell International Inc. | Redundantly connected wireless sensor networking methods |
US7591002B2 (en) | 2005-06-09 | 2009-09-15 | Microsoft Corporation | Conditional activation of security policies |
US7856001B2 (en) | 2005-06-15 | 2010-12-21 | U4Ea Wireless, Inc. | Wireless mesh routing protocol utilizing hybrid link state algorithms |
US8463319B2 (en) | 2005-06-17 | 2013-06-11 | Honeywell International Inc. | Wireless application installation, configuration and management tool |
US8050624B2 (en) | 2005-06-24 | 2011-11-01 | Rosemount, Inc. | Distributed process control system and method utilizing wireless communication of packet messages |
US20070030816A1 (en) | 2005-08-08 | 2007-02-08 | Honeywell International Inc. | Data compression and abnormal situation detection in a wireless sensor network |
US7801094B2 (en) | 2005-08-08 | 2010-09-21 | Honeywell International Inc. | Integrated infrastructure supporting multiple wireless devices |
DE102005040889A1 (de) | 2005-08-29 | 2007-03-15 | Siemens Ag | Verfahren und Anordnung zum sicheren Übertragen von Daten in einem ein Mehrsprungverfahren nutzenden Kommunikationssystem |
US8220042B2 (en) | 2005-09-12 | 2012-07-10 | Microsoft Corporation | Creating secure interactive connections with remote resources |
US8312264B2 (en) * | 2005-09-30 | 2012-11-13 | Blue Coat Systems, Inc. | Method and system for authentication among peer appliances within a computer network |
US7603129B2 (en) | 2005-10-05 | 2009-10-13 | Honeywell International Inc. | Localization identification system for wireless devices |
US7289466B2 (en) | 2005-10-05 | 2007-10-30 | Honeywell International Inc. | Localization for low cost sensor network |
TWI284462B (en) | 2005-10-07 | 2007-07-21 | Delta Electronics Inc | Optical transceiver module and calibration method thereof |
US20070087763A1 (en) | 2005-10-18 | 2007-04-19 | Honeywell International Inc. | Location aware wireless security |
US8644192B2 (en) | 2005-10-21 | 2014-02-04 | Honeywell International Inc. | Wireless transmitter initiated communication methods |
US8139521B2 (en) | 2005-10-28 | 2012-03-20 | Interdigital Technology Corporation | Wireless nodes with active authentication and associated methods |
US8406220B2 (en) | 2005-12-30 | 2013-03-26 | Honeywell International Inc. | Method and system for integration of wireless devices with a distributed control system |
US8285326B2 (en) | 2005-12-30 | 2012-10-09 | Honeywell International Inc. | Multiprotocol wireless communication backbone |
US7765399B2 (en) | 2006-02-22 | 2010-07-27 | Harris Corporation | Computer architecture for a handheld electronic device |
US8311214B2 (en) | 2006-04-24 | 2012-11-13 | Motorola Mobility Llc | Method for elliptic curve public key cryptographic validation |
US20070255966A1 (en) | 2006-05-01 | 2007-11-01 | Vincenzo Condorelli | Cryptographic circuit with voltage-based tamper detection and response circuitry |
US8381306B2 (en) | 2006-05-30 | 2013-02-19 | Microsoft Corporation | Translating role-based access control policy to resource authorization policy |
US8412927B2 (en) | 2006-06-07 | 2013-04-02 | Red Hat, Inc. | Profile framework for token processing system |
US8527770B2 (en) | 2006-07-20 | 2013-09-03 | Research In Motion Limited | System and method for provisioning device certificates |
WO2008011376A2 (en) | 2006-07-21 | 2008-01-24 | General Electric Company | System and method for providing network device authentication |
US7804807B2 (en) | 2006-08-02 | 2010-09-28 | Motorola, Inc. | Managing establishment and removal of security associations in a wireless mesh network |
US7734052B2 (en) | 2006-09-07 | 2010-06-08 | Motorola, Inc. | Method and system for secure processing of authentication key material in an ad hoc wireless network |
US8051488B2 (en) | 2006-10-05 | 2011-11-01 | Microsoft Corporation | Trial usage for encrypted subscription-based data |
US7817802B2 (en) | 2006-10-10 | 2010-10-19 | General Dynamics C4 Systems, Inc. | Cryptographic key management in a communication network |
CA2900269A1 (en) | 2007-02-02 | 2008-09-18 | Telcordia Technologies, Inc. | Method and system to authorize and assign digital certificates without loss of privacy |
US8364846B2 (en) | 2007-02-02 | 2013-01-29 | Silver Spring Networks, Inc. | Method and system of providing IP-based packet communications with in-premisis devices in a utility network |
US20080273547A1 (en) | 2007-05-01 | 2008-11-06 | Honeywell International, Inc. | Apparatus and method for acknowledging successful transmissions in a wireless communication system |
US20080292105A1 (en) | 2007-05-22 | 2008-11-27 | Chieh-Yih Wan | Lightweight key distribution and management method for sensor networks |
US8539110B2 (en) | 2007-07-03 | 2013-09-17 | Fieldbus Foundation | Block-orientated control system having wireless gateway for communication with wireless field devices |
US8280057B2 (en) | 2007-09-04 | 2012-10-02 | Honeywell International Inc. | Method and apparatus for providing security in wireless communication networks |
US8122497B2 (en) | 2007-09-10 | 2012-02-21 | Redcloud, Inc. | Networked physical security access control system and method |
US8775790B2 (en) | 2007-10-30 | 2014-07-08 | Honeywell International Inc. | System and method for providing secure network communications |
US8681676B2 (en) | 2007-10-30 | 2014-03-25 | Honeywell International Inc. | System and method for providing simultaneous connectivity between devices in an industrial control and automation or other system |
US20090276537A1 (en) | 2007-12-20 | 2009-11-05 | Deverick James W | Mechanisms for role negotiation in the establishment of secure communication channels in peer-to-peer environments |
US10015158B2 (en) * | 2008-02-29 | 2018-07-03 | Blackberry Limited | Methods and apparatus for use in enabling a mobile communication device with a digital certificate |
US8429435B1 (en) | 2008-07-25 | 2013-04-23 | Autani Corporation | Automation devices, systems, architectures, and methods for energy management and other applications |
US20100050267A1 (en) | 2008-08-20 | 2010-02-25 | Zoltan Nochta | Method and system for the automated transformation of access control management information in computer systems |
EP2159653B1 (de) | 2008-09-02 | 2014-07-23 | Siemens Aktiengesellschaft | Verfahren zur Einräumung einer Zugriffsberechtigung auf ein rechnerbasiertes Objekt in einem Automatisierungssystem, Computerprogramm und Automatisierungssystem |
US9344438B2 (en) | 2008-12-22 | 2016-05-17 | Qualcomm Incorporated | Secure node identifier assignment in a distributed hash table for peer-to-peer networks |
US8307085B2 (en) | 2010-03-16 | 2012-11-06 | Microsoft Corporation | Storing state of distributed architecture in external store |
US8635442B2 (en) * | 2009-04-28 | 2014-01-21 | Adobe Systems Incorporated | System and method for long-term digital signature verification utilizing light weight digital signatures |
US8873746B2 (en) | 2010-01-28 | 2014-10-28 | Intel Corporation | Establishing, at least in part, secure communication channel between nodes so as to permit inspection, at least in part, of encrypted communication carried out, at least in part, between the nodes |
WO2011130713A1 (en) * | 2010-04-15 | 2011-10-20 | General Instrument Corporation | Online secure device provisioning with updated offline identity data generation and offline device binding |
US8627083B2 (en) | 2010-10-06 | 2014-01-07 | Motorala Mobility LLC | Online secure device provisioning with online device binding using whitelists |
DE102011108003B4 (de) | 2011-07-19 | 2013-07-25 | Abb Technology Ag | Prozessleitsystem |
CN102255925B (zh) * | 2011-08-30 | 2016-01-20 | 公安部第三研究所 | 一种数字证书申请快速审核方法 |
EP2587715B1 (de) * | 2011-09-20 | 2017-01-04 | BlackBerry Limited | Unterstützte Zertifikatsregistrierung |
US8909930B2 (en) | 2011-10-31 | 2014-12-09 | L-3 Communications Corporation | External reference monitor |
US9635029B2 (en) | 2012-01-27 | 2017-04-25 | Honeywell International Inc. | Role-based access control permissions |
US8750502B2 (en) | 2012-03-22 | 2014-06-10 | Purdue Research Foundation | System on chip and method for cryptography using a physically unclonable function |
US8966247B2 (en) * | 2012-07-03 | 2015-02-24 | International Business Machines Corporation | Managing security certificates of storage devices |
US9503478B2 (en) | 2014-01-27 | 2016-11-22 | Honeywell International Inc. | Policy-based secure communication with automatic key management for industrial control and automation systems |
US20140281497A1 (en) * | 2013-03-13 | 2014-09-18 | General Instrument Corporation | Online personalization update system for externally acquired keys |
KR101612751B1 (ko) * | 2013-04-26 | 2016-04-15 | 비자 인터네셔널 서비스 어소시에이션 | 디지털 인증서의 제공 |
US9386008B2 (en) | 2013-08-19 | 2016-07-05 | Smartguard, Llc | Secure installation of encryption enabling software onto electronic devices |
US9438628B2 (en) | 2014-01-27 | 2016-09-06 | Honeywell International Inc. | Apparatus and method for securing a distributed control system (DCS) |
US10244000B2 (en) | 2014-02-24 | 2019-03-26 | Honeywell International Inc. | Apparatus and method for establishing seamless secure communications between components in an industrial control and automation system |
CN105281908B (zh) * | 2014-07-23 | 2019-08-06 | 阿里巴巴集团控股有限公司 | USB Key、USB Key数字证书写入方法和装置 |
US20160127353A1 (en) | 2014-10-30 | 2016-05-05 | Motorola Solutions, Inc. | Method and apparatus for enabling secured certificate enrollment in a hybrid cloud public key infrastructure |
WO2016137517A1 (en) * | 2015-02-27 | 2016-09-01 | Hewlett Packard Enterprise Development Lp | Manufacturer-signed digital certificate for identifying a client system |
US9635003B1 (en) | 2015-04-21 | 2017-04-25 | The United States Of America As Represented By The Director, National Security Agency | Method of validating a private-public key pair |
US9787478B2 (en) | 2015-06-10 | 2017-10-10 | Qualcomm Incorporated | Service provider certificate management |
US10038552B2 (en) | 2015-11-30 | 2018-07-31 | Honeywell International Inc. | Embedded security architecture for process control systems |
CN105721489A (zh) * | 2016-03-16 | 2016-06-29 | 四川长虹电器股份有限公司 | 基于数字证书对ip白名单中的ip认证方法与*** |
JP6668183B2 (ja) * | 2016-07-01 | 2020-03-18 | 株式会社東芝 | 通信装置、通信方法、通信システムおよびプログラム |
US10164778B2 (en) * | 2016-12-15 | 2018-12-25 | Alibaba Group Holding Limited | Method and system for distributing attestation key and certificate in trusted computing |
-
2018
- 2018-02-07 US US15/891,095 patent/US10749692B2/en active Active
- 2018-05-02 CN CN201880026005.8A patent/CN110546917A/zh active Granted
- 2018-05-02 EP EP18794197.6A patent/EP3619888B1/de active Active
- 2018-05-02 WO PCT/US2018/030608 patent/WO2018204471A1/en active Application Filing
- 2018-05-02 AU AU2018261368A patent/AU2018261368A1/en not_active Abandoned
Also Published As
Publication number | Publication date |
---|---|
AU2018261368A1 (en) | 2019-11-14 |
WO2018204471A1 (en) | 2018-11-08 |
EP3619888A1 (de) | 2020-03-11 |
CN110546917A (zh) | 2019-12-06 |
US20180323977A1 (en) | 2018-11-08 |
EP3619888A4 (de) | 2020-12-23 |
US10749692B2 (en) | 2020-08-18 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP3619888B1 (de) | Automatisierte zertifikatsregistrierung für vorrichtungen in industriereglerystemen oder anderen systemen | |
US12008110B2 (en) | System and method for recording device lifecycle transactions as versioned blocks in a blockchain network using a transaction connector and broker service | |
US10855448B2 (en) | Apparatus and method for using blockchains to establish trust between nodes in industrial control systems or other systems | |
US10469480B2 (en) | System and method for securing data transport between a non-IP endpoint device that is connected to a gateway device and a connected service | |
US9397836B2 (en) | Securing devices to process control systems | |
US11102013B2 (en) | Method and apparatus for providing secure communication among constrained devices | |
US11405373B2 (en) | Blockchain-based secured multicast communications | |
US8837740B2 (en) | Device and method for securing a negotiation of at least one cryptographic key between units | |
US20160057134A1 (en) | Updating of a Digital Device Certificate of an Automation Device | |
US9503478B2 (en) | Policy-based secure communication with automatic key management for industrial control and automation systems | |
US20170366537A1 (en) | Secure efficient registration of industrial intelligent electronic devices | |
WO2014055381A1 (en) | System and methods for authentication between networked devices | |
US20170324564A1 (en) | Systems and methods for enabling trusted communications between entities | |
US12047494B2 (en) | Protected protocol for industrial control systems that fits large organizations | |
US20160323266A1 (en) | Method, management apparatus and device for certificate-based authentication of communication partners in a device | |
US20180137297A1 (en) | Security system for industrial control system | |
CN113711566A (zh) | 在设备上提供数据 | |
CA2871392A1 (en) | Policy- based secure communication with automatic key management for industrial control and automation systems |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE |
|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE |
|
17P | Request for examination filed |
Effective date: 20191104 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
AX | Request for extension of the european patent |
Extension state: BA ME |
|
DAV | Request for validation of the european patent (deleted) | ||
DAX | Request for extension of the european patent (deleted) | ||
A4 | Supplementary search report drawn up and despatched |
Effective date: 20201124 |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: H04L 9/08 20060101ALN20201118BHEP Ipc: H04L 29/08 20060101ALI20201118BHEP Ipc: H04L 29/06 20060101ALI20201118BHEP Ipc: H04L 9/32 20060101AFI20201118BHEP Ipc: G05B 19/418 20060101ALI20201118BHEP |
|
P01 | Opt-out of the competence of the unified patent court (upc) registered |
Effective date: 20230414 |
|
REG | Reference to a national code |
Ref document number: 602018068605 Country of ref document: DE Ref country code: DE Ref legal event code: R079 Free format text: PREVIOUS MAIN CLASS: H04L0009320000 Ipc: H04L0009400000 |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: GRANT OF PATENT IS INTENDED |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: H04L 67/12 20220101ALI20231110BHEP Ipc: H04L 9/32 20060101ALI20231110BHEP Ipc: H04L 9/40 20220101AFI20231110BHEP |
|
INTG | Intention to grant announced |
Effective date: 20231211 |
|
GRAS | Grant fee paid |
Free format text: ORIGINAL CODE: EPIDOSNIGR3 |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE PATENT HAS BEEN GRANTED |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
REG | Reference to a national code |
Ref country code: GB Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: EP |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R096 Ref document number: 602018068605 Country of ref document: DE |
|
REG | Reference to a national code |
Ref country code: IE Ref legal event code: FG4D |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: GB Payment date: 20240527 Year of fee payment: 7 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: DE Payment date: 20240529 Year of fee payment: 7 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: FR Payment date: 20240527 Year of fee payment: 7 |